rbls.de

rbls.de is currently providing two RBLs.

nixspam.rbls.de

… is compareable to ix.dnsbl.manitu.net, which itself is a list built upon a datafeed provided by the NiX Spam project of iX author Bert Ungerer.

I wrote a script that downloads the files nixspam.blackmatches and nixspam.cachematches in a 15 minute interval and imports them into a PostgreSQL database. My script also counts how often an IP or hash appears with different timestamps. On the first occurance an IP or hash will be listed for 96 hours. Unlike the original RBL, each additional time an email from the same IP or with the same hash is caught by an iX spamtrap, the timecounter resets and another 24 hours of listingtime will be added on top. If your IP or hash does not get caught in a spamtrap for 30 consecutive days, its record is being deleted.

Lookup an IP or hash:

wildcard.rbls.de

… contains all IP addresses and MX hosts that are listed as mailserver for nonexistant domains.

To explain this a little further: Some registries set wildcard records for their top-level domains. An example would be -.tk, which - at the time of writing this text - resolves to four IP addresses and even has an MX record set. If you surf to that domain, you're being told that The domain name you have entered is invalid, yet it works perfectly fine.

This behaviour shows, that the .tk registry set up a wildcard record to link surfers to their own website, who are trying to access an unregistered domain. Unfortunately this means that spammers can just randomly use any .tk-domainname for spamming and pass (some) important spamchecks with it.

The contents of this rbl is being fully automatically reevaluated once a day.

Lookup an IP or host: